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What is claimed is: 



y 



1 . A system for monitoring a communications network having data streams 
that carry data packets between a plurality of nodes by way of physical connections 
comprising: 

5 a plurality of measurement probes, each probe for passively collecting the data 

packets carried by a data stream in a physical connection to produce a set; 

a plurality of characterization computational units, each characterization 
computational unit for receiving the set of collected data packets from a respective 
one of the plurality of probes and for producing a data stream characterization from 

10 the set; and 

a configuration processing unit for generating a system configuration for the 
communications network from the data stream characterization. 



2. The system of Claim 1, wherein the data stream characterization produced 
by each characterization computational unit comprises an array of hash values 

1 5 computed from an invariant portion of selected data packets taken from the set of 
collected data packets. 

3. The system of Claim 1 , wherein the data stream characterization produced 
by each characterization computational unit comprises an array of counts of a number 
of times each possible hash value occurs when hash values are computed from an 

20 invariant portion of selected data packets taken from the set of collected data packets. 

4. The system of Claim 1 , wherein the data stream characterization produced 
by each characterization computational unit comprises an array of counts, the counts 
corresponding to a number of packets between occurrences of a packet that produces 
a key hash value when hash values are computed from an invariant portion of selected 

25 data packets taken from the set of collected data packets. 
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5. The system of Claim 1, wherein the data stream characterization produced 
by each characterization computational unit comprises an array of hash values 
computed from groups of data packets, one hash value for each group of data packets, 
wherein the groups are produced by selecting subsets from the set of collected data 

5 packets. 

6. The system of Claim 2, wherein the array of hash values are computed 
using an XOR hash algorithm. 

7. The system of Claim 3, wherein the array of hash values are computed 
using an XOR hash algorithm. 

10 8. The system of Claim 4, wherein the array of hash values are computed 

using an XOR hash algorithm. 

9. The system of Claim 5, wherein the array of hash values are computed 
using an XOR hash algorithm. 

10. The system of Claim 1, wherein the system configuration is generated by 
1 5 successively comparing data stream characterizations to find matching pairs of 

characterizations. 

11. A method for monitoring a communications network having data streams 
that carry data packets between a plurality of nodes by way of physical connections 
comprising the steps of: 

20 passively probing one or more of the physical connections to produce one or 

more sets of collected data packets from the data streams; 

determining a data stream characterization from each the sets of collected data 
packets; and 

comparing the data stream characterizations to one another to identify matching 
25 characterizations. 
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12. The method of Claim 11, wherein the step of determining comprises the 
steps of: 

recording peripheral information associated with the data stream 
characterization; and 

5 computing an array of values from an invariant portion of the set of collected 

data packets. 

13. The method of Claim 12, wherein the step of computing the array of values 
comprises the steps of: 

selecting data packets from the set of collected data packets; 
10 computing a hash value from the invariant portion of the selected data packets, 

wherein one hash value is computed for each of the selected data packets; and 
storing the computed hash values in an array. 

14. The method of Claim 12, wherein the step of computing the array of 
values comprises the steps of: 

15 selecting data packets from the set of collected data packets; 

computing a hash value from the invariant portion of the selected data packets, 
wherein one hash value is computed for each of the selected data packets; 
counting each occurrence of each hash value; and 
storing the counted occurrences in an array. 

20 15. The method of Claim 12, wherein the step of computing the array of 

values comprises the steps of: 

selecting data packets from the set of collected data packets; 
computing a hash value from the invariant portion of the selected data packets, 
wherein one hash value is computed for each of the selected data packets; 
25 counting a number of hash values that occur between each occurrence of a pre- 

selected key hash value; and 

storing each of the counted numbers in an array. 
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16. The method of Claim 12, wherein the step of computing the array of 
values comprises the steps of: 

selecting data packets from the set of collected data packets to produce a subset 
of selected data packets; 
5 selecting data packets from the subset of selected data packets to produce groups 

of data packets; 

computing a hash value from the invariant portion of the data packets in each of 
the groups, wherein one hash value is computed for each group of data packets; and 
storing the computed hash values in an array. 

10 17. The method of Claim 13, wherein the step of computing a hash value uses 

an XOR hash algorithm. 

18. The method of Claim 14, wherein the step of computing a hash value uses 
an XOR hash algorithm. 

1 9. The method of Claim 1 5, wherein the step of computing a hash value uses 
1 5 an XOR hash algorithm. 

20. The method of Claim 16, wherein the step of computing a hash value uses 
an XOR hash algorithm. 




